Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 01:08

General

  • Target

    2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe

  • Size

    637KB

  • MD5

    6e82252e3ce511a42ba01007dc53b7b5

  • SHA1

    0dfd9a3b54c59c3e0455f4e632770cf84626af6d

  • SHA256

    2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609

  • SHA512

    48b57bcc64b9071f05a718fc05511b00bb34dd351d76bc7828c93b5441fbf7e4fc1c42e844d68ca8f2a9525d7e9d89b9547a88c00ebe9835dab3008edd878679

  • SSDEEP

    12288:f8oTmXIyxqNFmhoKAzWgi96IAEy9UhK+8TAQ5+rROXP:EoTWq76oKADi96kyK104If

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe
    "C:\Users\Admin\AppData\Local\Temp\2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Users\Admin\AppData\Local\Temp\2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe
      "C:\Users\Admin\AppData\Local\Temp\2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsf6CE4.tmp\System.dll

    Filesize

    11KB

    MD5

    b0c77267f13b2f87c084fd86ef51ccfc

    SHA1

    f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

    SHA256

    a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

    SHA512

    f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

  • memory/1808-12-0x0000000077808000-0x0000000077809000-memory.dmp

    Filesize

    4KB

  • memory/1808-13-0x0000000077825000-0x0000000077826000-memory.dmp

    Filesize

    4KB

  • memory/1808-14-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/1808-16-0x0000000077781000-0x00000000778A1000-memory.dmp

    Filesize

    1.1MB

  • memory/4984-10-0x0000000077781000-0x00000000778A1000-memory.dmp

    Filesize

    1.1MB

  • memory/4984-11-0x00000000745E4000-0x00000000745E5000-memory.dmp

    Filesize

    4KB